MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1048Exfiltration Over Alternative Protocol

Exfiltration

View on MITRE ATT&CK →

1 Query

Large Outbound Data Transfer to Uncommon External IP

highexperimentalDefender XDR

Microsoft Defender for Endpoint·DeviceNetworkEvents

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where RemotePort !in (80, 443)
| summarize TotalBytesSent = sum(SentBytes), ConnectionCount = count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, bin(Timestamp, 1h)
| where TotalBytesSent > 104857600
| extend TotalMBSent = round(TotalBytesSent / 1048576.0, 2)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, TotalMBSent, ConnectionCount
| sort by TotalMBSent desc

Microsoft (adapted) · last tested 2025-03-01

Tuning notes

Backup to cloud, software updates, and video conferencing generate large outbound traffic. Exclude known backup destination IPs and common application ports.

+ Add another query for this technique →